Years ago I worked with a national grocery chain to figure out what they stood to lose if someone got into their freezers, and how well they could protect them. The refrigeration controls were on the network, so we tested whether an outsider could reach them and take control of the units.
They had a backup plan: a refrigerated semi truck. If one store’s freezers went down, they could load that store into the truck and keep the food cold. One store was covered.
An average grocery store carries about $368,000 in refrigerated perishables, and a full-service store carries more than $900,000. If 15 stores go down at once, the truck saves one. The other 14 add up to somewhere between $5.2 million and $12.6 million in spoiled food, before lost sales, cleanup, and restocking.
What happened in France
This month it happened at a much bigger scale. Attackers got into refrigeration controllers at more than 300 Intermarché stores, more than 100 Coopérative U stores, and 80 Carrefour supermarkets, plus E. Leclerc stores through one of its equipment suppliers. They forced the cases into defrost. Temperatures climbed, food spoiled, and some stores caught fire. Intermarché told affected stores to throw out all of their fresh and frozen food.
The controllers came from Danfoss, and the company said most of the affected equipment was legacy hardware that no longer gets security updates.
It isn’t only freezers. In August, a ransomware attack hit a Canadian hospital’s door access and HVAC monitoring. In another case, a company refused to pay, the attackers locked everyone out of the office, and police broke windows to get in.
The semi truck was their walk-away option
In negotiation terms, the truck was their BATNA, their best alternative to a negotiated agreement. If an attacker took out one store and asked for money, the chain could say no and load the truck.
Take out every store at once and the truck is off the table. The chain goes from “we have a plan” to “we have a few hours.” Hitting the freezers is really a way to take away your walk-away option.
Against a $12 million loss, a $2 million ransom starts to look like a bargain, and the attacker is counting on you doing that math.
When the leverage is stolen data, you have time. You can stall, ask for proof, and work the price down over days. When the leverage is a freezer, the clock runs by the hour. Food spoils on a schedule, and the attacker knows exactly how fast.
Questions for the board
These apply to convenience chains as much as supermarkets. Convenience stores run the same coolers and the same remote vendor access, usually with a smaller IT team.
Which of our building systems are on the network, coolers and freezers included, and which vendors can reach them?
Is any of that equipment past the point of getting security updates?
What’s our truck? For each critical system, what’s the manual fallback, and how many stores can it cover at once?
How many stores can fail at the same time before the fallback runs out, and what does that cost?
If this lands Sunday at 11 p.m., who makes the call, and how fast can we reach them?
Sources: The Register, CBS News, Food Safety Magazine
